How to use Keycloack in KeepHQ open source?

[hightwoltt]

I have a free copy of keephq deployed in Docker. I Use
keep-fronted image: us-central1-docker.pkg.dev/keephq/keep/keep-ui
and
keep-backend image: us-central1-docker.pkg.dev/keephq/keep/keep-api
I added unnecessary variables to the environment for the Keycloack garter. But after authorization, I get to the page as in the screenshot.

Please tell me, can I even use Keycloak in KeepHQ open source? And how can I fix this error

[dosubot[bot]]

Hi @hightwoltt! I'm Dosu and I’m helping the keep team.

Keycloak authentication is not supported in the open-source version of KeepHQ—this feature is only available in Keep Cloud and Keep Enterprise On-Premises. The error you see after Keycloak authorization is expected in the open-source edition, as the integration is not available there, regardless of environment variable configuration. For authentication in the open-source version, use the supported methods like local or basic auth. More details are in the official docs: Keycloak authentication support.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}   

[hightwoltt]

Thanks for you reply!
Do I understand correctly that I can use "basic auth" for my keep-hq installation? Please tell me how it is implemented

[dosubot[bot]]

Yes, you can use "basic auth" in the open-source version of KeepHQ, but it's implemented as "DB authentication"—a username/password login system, not classic HTTP Basic Auth headers.

To enable it in your Docker deployment, set the following environment variables:

• AUTH_TYPE=DB (on both backend and frontend)
• KEEP_JWT_SECRET (a strong secret for JWT token generation, required on the backend)
• Optionally, set KEEP_DEFAULT_USERNAME and KEEP_DEFAULT_PASSWORD to define the initial admin user (defaults to keep/keep)

You can use the provided docker-compose-with-auth.yml as a template for setup. After starting KeepHQ, log in with your admin credentials. You can manage users via the UI or API. Authentication works by issuing a JWT token after login, which is used for session management—not via HTTP Basic Auth headers.

Full details and sample configs are in the docs:

• Authentication overview
• DB authentication setup
• Environment variables reference

This method is recommended for self-hosted and small team deployments.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}   

[shahargl]

hey @hightwoltt,

first, Keycloak is under enterprise directory.
second, you should have a more verbose error on your frontend container container. can you dump it?